Editing IEEE 802.11 (section)

==Layer 2 – Datagrams==
The [[datagram]]s are called ''frames''. Current 802.11 standards specify frame types for use in the transmission of data as well as management and control of wireless links.

Frames are divided into very specific and standardized sections. Each frame consists of a ''MAC header'', ''payload'', and ''[[frame check sequence]]'' (FCS). Some frames do not have payloads.

{| class="wikitable"
|-
! Field
| Frame <br/>control
| Duration, <br/>{{abbr|id.|association id.}}
| Address <br/>1
| Address <br/>2
| Address <br/>3
| Sequence <br/>control
| Address <br/>4
| {{abbr|QoS|Quality of service}} <br/>control
| {{abbr|HT|High throughput}} <br/>control
| Frame <br/>body
| Frame check <br/>sequence
|-
! Length (Bytes)
| 2
| 2
| 6
| 6
| 6
| 0, or 2
| 6
| 0, or 2
| 0, or 4
| {{n/a|''Variable''}}
| 4
|}

The first two bytes of the MAC header form a frame control field specifying the form and function of the frame. This frame control field is subdivided into the following sub-fields:
* Protocol Version: Two bits representing the protocol version. The currently used protocol version is zero. Other values are reserved for future use.
* Type: Two bits identifying the type of WLAN frame. Control, Data, and Management are various frame types defined in IEEE 802.11.
* Subtype: Four bits providing additional discrimination between frames. Type and Subtype are used together to identify the exact frame.
* ToDS and FromDS: Each is one bit in size. They indicate whether a data frame is headed for a distribution system or it is getting out of it. Control and management frames set these values to zero. All the data frames will have one of these bits set.
** ToDS = 0 and FromDS = 0
*** Communication within a [[Service set (802.11 network)|basic service set]] or an [[independent basic service set]] (IBSS) network.
**ToDS = 0 and FromDS = 1
***A frame sent by a station and directed to an AP accessed via the distribution system.
**ToDS = 1 and FromDS = 0
***A frame exiting the distribution system for a station.
**ToDS = 1 and FromDS = 1
***Only kind of frame frame that uses all four MAC addresses in a DATA frame.
***Address 1: access point address exiting from the distribution system.
***Address 2: access point entrance to the distribution system (AP to which the source station is connected).
***Address 3: final station address.
***Address 4: address of the source station.<ref>{{Cite web |date=2010-10-25 |title=802.11 frames : A starter guide to learn wireless sniffer traces |url=https://community.cisco.com/t5/wireless-mobility-knowledge-base/802-11-frames-a-starter-guide-to-learn-wireless-sniffer-traces/ta-p/3110019 |access-date=2023-01-24 |website=community.cisco.com |language=en}}</ref><ref>{{Cite book |last=Gast |first=Matthew S. |title=802.11 wireless networks: the definitive guide; [creating & administering wireless networks; covers 802.11a, g, n & i] |date=2013 |publisher=O'Reilly |isbn=978-0-596-10052-0 |edition=2nd |location=Beijing |chapter=Chapter 4. 802.11 Framing in Detail |chapter-url=https://www.oreilly.com/library/view/80211-wireless-networks/0596100523/ch04.html}}</ref>
* More Fragments: The More Fragments bit is set when a packet is divided into multiple frames for transmission. Every frame except the last frame of a packet will have this bit set.
* Retry: Sometimes frames require retransmission, and for this, there is a Retry bit that is set to one when a frame is resent. This aids in the elimination of duplicate frames.
* Power Management: This bit indicates the power management state of the sender after the completion of a frame exchange. Access points are required to manage the connection and will never set the power-saver bit.
* More Data: The More Data bit is used to buffer frames received in a distributed system. The access point uses this bit to facilitate stations in power-saver mode. It indicates that at least one frame is available and addresses all stations connected.
* Protected Frame: The Protected Frame bit is set to the value of one if the frame body is encrypted by a protection mechanism such as [[Wired Equivalent Privacy]] (WEP), [[Wi-Fi Protected Access]] (WPA), or Wi-Fi Protected Access II (WPA2).
* Order: This bit is set only when the "strict ordering" delivery method is employed. Frames and fragments are not always sent in order as it causes a transmission performance penalty.

The next two bytes are reserved for the Duration ID field, indicating how long the field's transmission will take so other devices know when the channel will be available again. This field can take one of three forms: Duration, Contention-Free Period (CFP), and Association ID (AID).

An 802.11 frame can have up to four address fields. Each field can carry a [[MAC address]]. Address 1 is the receiver, Address 2 is the transmitter, Address 3 is used for filtering purposes by the receiver.{{Dubious|date=December 2015}} Address 4 is only present in data frames transmitted between access points in an [[Extended Service Set]] or between intermediate nodes in a [[mesh network]].

The remaining fields of the header are:
* The Sequence Control field is a two-byte section used to identify message order and eliminate duplicate frames. The first 4 bits are used for the fragmentation number, and the last 12 bits are the sequence number.
* An optional two-byte Quality of Service control field, present in QoS Data frames; it was added with [[802.11e]].

The payload or frame body field is variable in size, from 0 to 2304 bytes plus any overhead from security encapsulation, and contains information from higher layers.

The Frame Check Sequence (FCS) is the last four bytes in the standard 802.11 frame. Often referred to as the Cyclic Redundancy Check (CRC), it allows for integrity checks of retrieved frames. As frames are about to be sent, the FCS is calculated and appended. When a station receives a frame, it can calculate the FCS of the frame and compare it to the one received. If they match, it is assumed that the frame was not distorted during transmission.<ref name="802.11 Technical Section">{{cite web|url=http://wifi.cs.st-andrews.ac.uk/wififrame.html|title=802.11 Technical Section|archive-url=https://web.archive.org/web/20090124151617/http://wifi.cs.st-andrews.ac.uk/wififrame.html|archive-date=2009-01-24|url-status=dead}}</ref>

===Management frames===
Management frames are [[IEEE 802.11w-2009|not always authenticated]], and allow for the maintenance, or discontinuance, of communication. Some common 802.11 subtypes include:
* Authentication frame: 802.11 authentication begins with the [[wireless network interface controller]] (WNIC) sending an authentication frame to the access point containing its identity.
** When open system authentication is being used, the WNIC sends only a single authentication frame, and the access point responds with an authentication frame of its own indicating acceptance or rejection.
** When shared key authentication is being used, the WNIC sends an initial authentication request, and the access point responds with an authentication frame containing challenge text. The WNIC then sends an authentication frame containing the encrypted version of the challenge text to the access point. The access point confirms the text was encrypted with the correct key by decrypting it with its own key. The result of this process determines the WNIC's authentication status.
* Association request frame: Sent from a station, it enables the access point to allocate resources and synchronize. The frame carries information about the WNIC, including supported data rates and the [[SSID]] of the network the station wishes to associate with. If the request is accepted, the access point reserves memory and establishes an association ID for the WNIC.
* Association response frame: Sent from an access point to a station containing the acceptance or rejection to an association request. If it is an acceptance, the frame will contain information such as an association ID and supported data rates.
* [[Beacon frame]]: Sent periodically from an access point to announce its presence and provide the [[SSID]] and other parameters for WNICs within range.
* {{vanchor|Deauthentication frame}}: Sent from a station wishing to terminate connection from another station.
* Disassociation frame: Sent from a station wishing to terminate the connection. It is an elegant way to allow the access point to relinquish memory allocation and remove the WNIC from the association table.
* Probe request frame: Sent from a station when it requires information from another station.
* Probe response frame: Sent from an access point containing capability information, supported data rates, etc., after receiving a probe request frame.
* Reassociation request frame: A WNIC sends a reassociation request when it drops from the currently associated access point range and finds another access point with a stronger signal. The new access point coordinates the forwarding of any information that may still be contained in the buffer of the previous access point.
* Reassociation response frame: Sent from an access point containing the acceptance or rejection to a WNIC reassociation request frame. The frame includes information required for association such as the association ID and supported data rates.
* Action frame: extending management frame to control a certain action. Some of the action categories are QoS, Block Ack, Public,<!-- See [[Remote ID]] --> Radio Measurement, Fast BSS Transition, Mesh Peering Management, etc. These frames are sent by a station when it needs to tell its peer for a certain action to be taken. For example, a station can tell another station to set up a [[block acknowledgement]] by sending an ''ADDBA Request'' action frame. The other station would then respond with an ''ADDBA Response'' action frame.

The body of a management frame consists of frame-subtype-dependent fixed fields followed by a sequence of [[information element]]s (IEs).

The common structure of an IE is as follows:

{| class="wikitable"
|-
! Field
| Type
| Length
| Data
|-
! Length
| 1
| 1
| 1–252
|}

===Control frames===
Control frames facilitate the exchange of data frames between stations. Some common 802.11 control frames include:
* Acknowledgement (ACK) frame: After receiving a data frame, the receiving station will send an ACK frame to the sending station if no errors are found. If the sending station does not receive an ACK frame within a predetermined period of time, the sending station will resend the frame.
* Request to Send (RTS) frame: The [[IEEE 802.11 RTS/CTS|RTS and CTS frames]] provide an optional collision reduction scheme for access points with hidden stations. A station sends an RTS frame as the first step in a two-way handshake required before sending data frames.
* Clear to Send (CTS) frame: A station responds to an RTS frame with a CTS frame. It provides clearance for the requesting station to send a data frame. The CTS provides collision control management by including a time value for which all other stations are to hold off transmission while the requesting station transmits.

===Data frames===
Data frames carry packets from web pages, files, etc. within the body.<ref name="Frame Types">{{cite web|url=http://www.wi-fiplanet.com/tutorials/article.php/1447501|title=Understanding 802.11 Frame Types|access-date=2008-12-14|url-status=dead|archive-url=https://web.archive.org/web/20081125033409/http://www.wi-fiplanet.com/tutorials/article.php/1447501|archive-date=2008-11-25}}</ref> The body begins with an [[IEEE 802.2]] header, with the Destination [[Service Access Point]] (DSAP) specifying the protocol, followed by a [[Subnetwork Access Protocol]] (SNAP) header if the DSAP is hex AA, with the [[organizationally unique identifier]] (OUI) and protocol ID (PID) fields specifying the protocol. If the OUI is all zeroes, the protocol ID field is an [[EtherType]] value.<ref>{{cite web|url=https://scm.info.ucl.ac.be/release/cnp3/Book/0.2/html/lan/lan.html#wireless-networks|archive-url=https://archive.today/20121127171405/https://scm.info.ucl.ac.be/release/cnp3/Book/0.2/html/lan/lan.html%23wireless-networks|archive-date=27 November 2012|url-status=dead|title=Computer Networking : Principles, Protocols and Practice|first=Olivier|last=Bonaventure|access-date=2012-07-09}}</ref> Almost all 802.11 data frames use 802.2 and SNAP headers, and most use an OUI of 00:00:00 and an EtherType value.

Similar to [[TCP congestion control]] on the internet, frame loss is built into the operation of 802.11. To select the correct transmission speed or [[Modulation and Coding Scheme]], a rate control algorithm may test different speeds. The actual packet loss rate of Access points varies widely for different link conditions. There are variations in the loss rate experienced on production Access points, between 10% and 80%, with 30% being a common average.<ref>{{cite conference|author1= D Murray |author2=T Koziniec |author3=M Dixon |author4=K. Lee|title=Measuring the reliability of 802.11 WiFi networks|conference=2015 Internet Technologies and Applications|year=2015|pages=233–238 |doi=10.1109/ITechA.2015.7317401|isbn=978-1-4799-8036-9 |s2cid=14997671 }}</ref> It is important to be aware that the link layer should recover these lost frames. If the sender does not receive an Acknowledgement (ACK) frame, then it will be resent.